Thanks for this tip. I see that in event ID 7035, source is always "Service Control Manager" but we don't have any of the dependant service running still SQL Server starts automatically. Any other tip?
–
Sakthivel ChidambaramMar 12 '10 at 13:54

The event log source is always Service Control Manager. You need to look in the text of the log entry to see what security principal issued the start command.
–
joeqwertyMar 12 '10 at 15:07